800-53|AC-6(2)

Title

NON-PRIVILEGED ACCESS FOR NONSECURITY FUNCTIONS

Description

The organization requires that users of information system accounts, or roles, with access to [Assignment: organization-defined security functions or security-relevant information], use non-privileged accounts or roles, when accessing nonsecurity functions.

Supplemental

This control enhancement limits exposure when operating from within privileged accounts or roles. The inclusion of roles addresses situations where organizations implement access control policies such as role-based access control and where a change of role provides the same degree of assurance in the change of access authorizations for both the user and all processes acting on behalf of the user as would be provided by a change between a privileged and non-privileged account.

Reference Item Details

Related: PL-4

Category: ACCESS CONTROL

Parent Title: LEAST PRIVILEGE

Family: ACCESS CONTROL

Baseline Impact: MODERATE,HIGH

Audit Items

View all Reference Audit Items

NamePluginAudit Name
1.1.1 Ensure Administrative accounts are separate and cloud-onlymicrosoft_azureCIS Microsoft 365 Foundations E3 L1 v3.0.0
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.2 Ensure that the API server pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.3.17.1 Set 'User Account Control: Admin Approval Mode for the Built-in Administrator account' to 'Enabled'WindowsCIS Windows 8 L1 v1.0.0
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.4 Ensure that the controller manager pod specification file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.6 Ensure that the scheduler pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.7 Set 'aaa accounting' to log all privileged use commands using 'commands 15'CiscoCIS Cisco IOS 15 L2 v4.1.1
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.8 Ensure that the etcd pod specification file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.10 Ensure that the Container Network Interface file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcdOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.14 Ensure that the admin.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.14 Ensure that the kubeconfig file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.16 Ensure that the Scheduler kubeconfig file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.16 Ensure that the scheduler.conf file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.18 Ensure that the Controller Manager kubeconfig file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.18 Ensure that the controller-manager.conf file ownership is set to root:rootUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.1.19 Ensure that the OpenShift PKI directory and file ownership is set to root:rootOpenShiftCIS RedHat OpenShift Container Platform 4 v1.5.0 L1
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.20 Benchmark v1.0.1 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.24 Benchmark v1.0.0 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes v1.23 Benchmark v1.0.1 L1 Master
1.1.20 Ensure that the Kubernetes PKI certificate file permissions are set to 600 or more restrictiveUnixCIS Kubernetes Benchmark v1.8.0 L1 Master
1.10 Ensure That 'Notify all admins when other admins reset their password?' is set to 'Yes'microsoft_azureCIS Microsoft Azure Foundations v2.0.0 L1